Blockchain-based anonymous trusted voting method, apparatus and related device

The present application claims priority to Chinese Patent Application No. 202210422851.X, titled “BLOCKCHAIN-BASED ANONYMOUS TRUSTED VOTING METHOD, APPARATUS AND RELATED DEVICE”, filed on Apr. 21, 2022 with the China National Intellectual Property Administration, which is incorporated herein by reference in its entirety.

The present disclosure relates to the technical field of blockchains, and in particular to a trusted anonymous voting method and apparatus based on a blockchain, and a related device.

The rapid development of a smart power grid system promotes the emergence of a modern power system known as “Internet of Energy” (IoE), which has drawn great interest from many countries. As an Internet-based solution for addressing energy issues, IoE has many key technologies and challenges to be addressed. One of the most common activities in the IoE is voting. For example, people may choose a proper energy broker through electronic voting. Although there are many electronic voting solutions, the IoE has a stricter requirement for the electronic voting solutions.

In addition to some common requirements such as correctness, eligibility, and coercion resistance in the electronic voting solutions, deployment of a voting service in the IoE is further required to meet requirements such as decentralization, anonymity, verifiability, and efficiency. Firstly, it is critical to handle voting without any kind of trusted third party (TTP) due to open and distributed features of the IoE. Secondly, it is critical to provide anonymity for voters enough because in a peer-to-peer marketplace of the IoE, a candidate may harm the voters in many unmonitored ways. Next, verifiability is provided because illegal activities are audited and punished in the IoE. Finally, basic services in the IoE are efficient and compatible with the system.

Although a series of effective protocols for anonymous electronic voting are provided in previous studies (for example, the electronic voting solution proposed by Helios and Backes et al.: [Ben Adida. Helios: Web-based open-audit voting. In USENIX security symposium, volume 17, 2018] and [Michael Backes, Martin Gagné, and Malte Skoruppa. Using mobile device communication to strengthen e-voting protocols. In Proceedings of the 12th ACM workshop on Workshop on privacy in the electronic society, pages 237-242, 2013]), a consistent view is to be provided by a web server implemented by an administrator or authority in the most solutions. As a result, a trusted third party is involved. However, with the trusted third party, the protocols are subjected to a single point of failure and are not available for a trustless environment in a new-style Internet.

Another issue is to provide verifiability along with anonymity, and the verifiability and anonymity seem to be two contradictory design goals. Some voting solutions (for example, an anonymous voting solution based on a blockchain proposed by Yang et al.: [Xuechao Yang, Xun Yi, Surya Nepal, Andrei Kelarev, and Fengling Han. Blockchain voting: Publicly verifiable online voting protocol without trusted tallying authorities. Future Generation Computer Systems, 112: 859-874, 2020]) have solved the issue through blockchain technology. However, lack of efficiency is the most defects in the technology.

In view of this, a trusted anonymous voting method and apparatus based on a blockchain, and a related device are provided according to the present disclosure, to realize decentralized anonymous voting.

v i v i In order to achieve the above objectives, a trusted anonymous voting method based on a blockchain is provided according to a first aspect of the present disclosure. The method includes: performing a hash operation on original voting content to obtain a hash output, where the hash output includes a commitment value c; blinding the commitment value cbased on information of other voters to obtain a commitment value tuple {tilde over (c)} and a commitment value tuple {tilde over (x)}; signing the commitment value tuple {tilde over (c)} by using an elliptic curve digital signature algorithm (ECDSA) to obtain a signature tuple {tilde over (s)}; and establishing a vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) based on the commitment value tuple {tilde over (c)}, the signature tuple {tilde over (s)} and a signature tuple {tilde over (d)} of other voters, and uploading the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) and the commitment value tuple {tilde over (x)} to the blockchain, where vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) serves as voting content in a voting stage, where the signature tuple {tilde over (d)} is generated in a case that other voters verify the signature tuple {tilde over (s)} and the signature tuple {tilde over (s)} passes the verification, and the commitment value tuple {tilde over (x)} is used to decrypt the vote tuple.

v i v i Preferably, the performing a hash operation on original voting content to obtain a commitment value cincludes: performing the hash operation on the original voting content m and a string o to obtain the commitment value c, where the string o is randomly generated.

v i j j v i j j j j j i Preferably, the blinding the commitment value cbased on information of other voters to obtain a commitment value tuple {tilde over (c)} and a commitment value tuple {tilde over (x)} includes: performing, for each of other voters, a point multiplication operation in an elliptic curve cryptography (ECC) on public key information pkandof the voter to obtain a blinding factor t; hashing the commitment value cbased on the blinding factor tto a new commitment value xand a new commitment value c; and collecting commitment values xto obtain a commitment value tuple {tilde over (x)}, and signing each of commitment values cby using a private key skto obtain the commitment value tuple {tilde over (c)}.

i i i i v Preferably, the signing the commitment value tuple {tilde over (c)} by using the ECDSA to obtain a signature tuple {tilde over (s)} includes: performing the hash operation on a tuple (ID, addr,) to obtain the signature tuple {tilde over (s)}, where IDand addrrepresent identification and address information of a target voter respectively, andrepresents a commitment value in the commitment value tuple {tilde over (c)} corresponding to a voter n.

v i n v v i n v n v v n v n v n v n v v i v i v i v i Preferably, the hash output further includes a commitment value o, and the method further includes: obtaining the signature tuple {tilde over (d)} and the commitment value tuple {tilde over (x)} from the blockchain, and calculating a signature tuple {tilde over (y)} of other voters based on the signature tuple {tilde over (d)}; verifying validity of ybased on the commitment value cand the commitment value tuple {tilde over (x)} by using a preset algorithm VerifyS to obtain all signature elements ythat pass the verification, where yrepresents a signature element in the signature tuple {tilde over (y)} corresponding to the voter n; obtaining a commitment string xcorresponding to each of the signature elements ythat pass the verification, establishing a new signature tuple {tilde over (y)} based on all the signature elements ythat pass the verification, and establishing a new commitment tuple {tilde over (x)} based on all commitment strings x; and uploading a vote tuple (c, o, {tilde over (x)}, {tilde over (y)}) to the blockchain with a random address, where the vote tuple (c, o, {tilde over (x)}, ý) serves as voting content in an opening voting stage.

v i v i v i v i Preferably, the trusted anonymous voting method based on a blockchain further includes: obtaining the vote tuple (c, o, {tilde over (x)}, {tilde over (y)}) from the blockchain, and verifying the signature tuple {tilde over (y)} by using a preset algorithm V; and verifying, in a case that more than a preset proportion of signature elements ŷ in the signature tuple {tilde over (y)} pass the verification, the original voting content based on the commitment tuples cand oby using the preset algorithm.

v i v i v i v i v i v i v i Preferably, the verifying the original voting content based on the commitment tuples cand oby using the preset algorithm includes: serializing the commitment tuple oto obtain a serialized string of commitment tuple o; performing the hash operation on the inputted original voting content m and the serialized string of commitment tuple o, to obtain a hash value ĉ; and determining whether ĉ is equal to c, and determining that the original voting content m passes the verification, in a case that ĉ is equal to c.

v i v i A trusted anonymous voting apparatus based on a blockchain is provided according to a second aspect of the present disclosure. The apparatus includes a commitment unit, a blinding unit, a signature unit, and a voting unit. The commitment unit is configured to perform a hash operation on original voting content to obtain a hash output, where the hash output includes a commitment value c. The blinding unit is configured to blind the commitment value cbased on information of other voters to obtain a commitment value tuple {tilde over (c)} and a commitment value tuple {tilde over (x)}. The signature unit is configured to sign the commitment value tuple {tilde over (c)} by using an elliptic curve digital signature algorithm (ECDSA) to obtain a signature tuple {tilde over (s)}. The voting unit is configured to establish a vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) based on the commitment value tuple {tilde over (c)}, the signature tuple {tilde over (s)} and a signature tuple {tilde over (d)} of other voters, and upload the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) and the commitment value tuple {tilde over (x)} to the blockchain, where the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) serves as voting content in a voting stage. The signature tuple {tilde over (d)} is generated in a case that other voters verify the signature tuple {tilde over (s)} and the signature tuple {tilde over (s)} passes the verification, and the commitment value tuple {tilde over (x)} is used to decrypt the vote tuple.

A trusted anonymous voting device based on a blockchain is provided according to a third aspect of the present disclosure. The device includes a memory and a processor. The memory is configured to store a program. The processor is configured to execute the program to perform the trusted anonymous voting method based on a blockchain described above.

A storage medium is provided according to a fourth aspect of the present disclosure. The storage medium stores a computer program. The computer program, when being executed by a processor, performs the trusted anonymous voting method based on a blockchain described above.

v i v i It can be seen from the above technical solutions that in the present disclosure, a hash operation is performed on the original voting content to obtain the hash output. The hash output includes the commitment value c. The hash operation enables the original voting content to be hidden well. Then, the commitment value cis blinded based on the information of other voters, to obtain the commitment value tuples {tilde over (c)} and {tilde over (x)}, so that identification of the voter is hidden well through the blinding. Next, the commitment value tuple {tilde over (c)} is signed by using the ECDSA to obtain the signature tuple {tilde over (s)}. The commitment value tuple is signed by the voter himself, so that the voting content is authenticated by the target voter, thereby preventing the voting content from being forged by others. Finally, the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) is established based on the commitment value tuple {tilde over (c)}, the signature tuple {tilde over (s)} and the signature tuple {tilde over (d)} of other voters, and the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) and the commitment value tuple {tilde over (x)} are uploaded to the blockchain. The vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) serves as the voting content in the voting stage. The signature tuple {tilde over (d)} is generated in a case that other voters verify the signature tuple {tilde over (s)} and the signature tuple {tilde over (s)} passes the verification. Due to verification and signature by other voters, the target voter cannot tamper with the voting content. The commitment value tuple {tilde over (x)} is used to decrypt the vote tuple, facilitating subsequent opening of the voting content and tally. In the present disclosure, through the above processing, the voting content is hidden and anonymity and verifiability of the voting are achieved.

Technical solutions in the embodiments of the present disclosure are described clearly and completely below in conjunction with the drawings in the embodiments of the present disclosure. Apparently, the embodiments described below are only some embodiments of the present disclosure, rather than all the embodiments. Any other embodiments obtained by those skilled in the art based on the embodiments in the present disclosure without any creative effort fall within the protection scope of the present disclosure.

1 FIG. For ease of understanding, an overall design idea of a trusted anonymous voting method based on a blockchain according to the present disclosure is introduced first. A main idea of the technical solution is introduced as follows with reference to. In order to vote for a ballot, a user first performs three cryptographic operations, i.e., commitment (for credibility), blinding (for anonymity) and signature (for verifiability) on a voting message to obtain a trusted anonymous voting result of original voting content, then performs a blind signature (for verifiability) on the trusted anonymous voting result by using a blind signature algorithm, and finally obtains voting information (expressed by a three-tuple) of the ballot. Then, the user uploads the voting information of the ballot to the blockchain, where a result of the blind signature is directly uploaded to the blockchain. In an opening voting stage, the user opens a commitment of a voting message obtained by the commitment and blinding, and the opened commitment is processed and uploaded to the blockchain. Finally, voting content (expressed by a four-tuple) of voters for the ballot is recorded in the blockchain. The user may verify whether the voting is valid in the blockchain. In a case that the voting is valid, a tally is performed for counting the voting result.

v 1 2 n v i v i v i v i i v i i v i v i v i 2 FIG. 101 104 The trusted anonymous voting method based on a blockchain according to an embodiment of the present disclosure is described in detail below. It can be understood that anyone in an Internet of Energy (IoE) system may launch voting through this solution. All voters who want to participate in the voting are required to provide their public keys and identification. Therefore, there is an initialization stage before the voting is launched. In the initialization stage, all public information of the voters is broadcasted to the blockchain through a preset smart contract. It is assumed that there are ndifferent voters v, v, . . . , v. Each of the voters vgenerates two pairs of keys (sk, pk) and (,) through elliptic curve cryptography (ECC). Assuming that addrrepresents a public address of the voter vin the Ethereum network, IDrepresents identification of the voter, and public information of the voter vis expressed as a tuple (ID, pk,, addr). Each of the voters may obtain the information from the blockchain and verify validity of the information. After the above initialization phase, referring to, the trusted anonymous voting method based on a blockchain according to the embodiment of the present disclosure may include the following steps Sto S.

101 In step S, a hash operation is performed on original voting content to obtain a hash output.

v i v i An input with an arbitrary length (also referred to as a pre-image) may be transformed into a hash output with a fixed length by using a hash algorithm. In this step, the hash output includes a commitment value c. This transformation is contraction mapping. That is, a size of a hash output is normally significantly smaller than a size of an input. Since different inputs may be hashed to a same hash output, the unique input cannot be determined from the hash output. The original voting content m is hashed to the commitment value cthrough the hash operation, so that the voting content can be hidden well. Therefore, other voters cannot obtain the voting content until the vote is opened.

102 v i In step S, the commitment value cis blinded based on information of other voters to obtain a commitment value tuple {tilde over (c)} and a commitment value tuple {tilde over (x)}.

v i The blinding may be performed by using a preset blind commitment algorithm. The information of other voters may be embedded in the commitment value cthrough the blinding, thereby hiding identity information of a target voter, so as to achieve anonymous voting.

103 In step S, the commitment value tuple {tilde over (c)} is signed by using an ECDSA to obtain a signature tuple {tilde over (s)}.

The commitment value tuple {tilde over (c)} is signed by using the ECDSA based on a private key of the target voter, so that the voting content is authenticated by the target voter, thereby preventing the voting content from being forged by others.

104 In step S, a vote tuple (ć, {tilde over (s)}, {tilde over (d)}) is established based on the commitment value tuple {tilde over (c)}, the signature tuple {tilde over (s)} and a signature tuple {tilde over (d)} of other voters, and the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) and the commitment value tuple {tilde over (x)} are uploaded to the blockchain.

The signature tuple {tilde over (d)} is generated in a case that other voters verify the signature tuple {tilde over (s)} and the signature tuple {tilde over (s)} passes the verification. The commitment value tuple {tilde over (x)} is used to decrypt the vote tuple. The vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) serves as the voting content in a voting stage.

v i v i In the embodiment of the present disclosure, a hash operation is performed on the original voting content to obtain the hash output. The hash output includes the commitment value c. The hash operation enables the original voting content to be hidden well. Then, the commitment value cis blinded based on the information of other voters, to obtain the commitment value tuples {tilde over (c)} and {tilde over (x)}, so that identification of the voter is hidden well through the blinding. Next, the commitment value tuple {tilde over (c)} is signed by using the ECDSA to obtain the signature tuple {tilde over (s)}. The commitment value tuple is signed by the voter himself, so that the voting content is authenticated by the target voter, thereby preventing the voting content from being forged by others. Finally, the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) is established based on the commitment value tuple {tilde over (c)}, the signature tuple {tilde over (s)} and the signature tuple {tilde over (d)} of other voters, and the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) and the commitment value tuple {tilde over (x)} are uploaded to the blockchain. The vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) serves as the voting content in the voting stage. The signature tuple {tilde over (d)} is generated in a case that other voters verify the signature tuple {tilde over (s)} and the signature tuple {tilde over (s)} passes the verification. Due to verification and signature by other voters, the target voter cannot tamper with the voting content. The commitment value tuple {tilde over (x)} is used to decrypt the vote tuple, facilitating subsequent opening of the voting content and tally. In the present disclosure, through the above process, the voting content is hidden and anonymity and verifiability of the voting are achieved.

101 v i v i In some embodiments of the present disclosure, in the step S, the hash operation is performed on the original voting content to obtain the commitment value cby: performing the hash operation on the original voting content m and a string o to obtain the commitment value c. The string o is randomly generated.

v i v i v i For example, the above hash operation may be implemented by using an algorithm C, i.e., (c, o)←C(m). Details of the algorithm C are as follows.

Algorithm C  Input (m) Output (c, o) 1: o=RandomBytes(32); 2: c=SHA256 (m + serialize(o)); 3: Return (c, o) ;

The algorithm C first generates a random string with 32 bytes as an open string o in the commitment. A commitment string c is a hash value generated from the original voting content m and o by using a collision-resistant hash algorithm SHA256, where a function serialize( ) in the algorithm C is used to serialize the string o.

102 1 3 v i In some embodiments of the present disclosure, in the step S, the commitment value cis blinded based on the information of other voters to obtain the commitment value tuple {tilde over (c)} and the commitment value tuple {tilde over (x)} by the following steps Sto S.

1 j j In step S, for each of other voters, a point multiplication operation in the elliptic curve cryptography (ECC) is performed on public key information pkandof the voter to obtain a blinding factor t.

2 v i j j In step S, the commitment value cis hashed to a new commitment value xi and a new commitment value cbased on the blinding factor t.

3 j j i In step S, commitment values xare collected to obtain a commitment value tuple {tilde over (x)} and each of commitment values cis signed by using a private key skto obtain the commitment value tuple {tilde over (c)}.

1 2 n v v i n v i v For example, the blinding may be performed by using an algorithm BlindX to generate the blinded commitment value tuples {tilde over (c)}=(,, . . . ,) and {tilde over (x)}=(,, . . . ,) corresponding to different voters v, v, . . . , vother than the target voter, i.e., ({tilde over (x)}, {tilde over (c)})←BlindX(c, pk,, sk) (it should be noted that in this specification, a small letter with a superscript ~ represents a string vector including nstrings, and a small letter with a superscript {circumflex over ( )} represents a string). Details of the algorithm BlindX are as follows.

Algorithm BlindX v i i Input (c,  ,  , sk) Output ({tilde over (x)}, {tilde over (c)}, γ, δ)  1: γ=RandomBytes(32);  2: δ=RandomBytes(32);  3: v forj=0 to ndo  4: j j  A=  + γ * G + pk* δ;  5: j j  t= getXpointFromPubkey(A)modn ;  6: j v i j  x= SHA256(c+ t) ;  7: j j  c= x− δ;  8: j  {tilde over (c)}.push(c) ;  9: i i i j  H= SHA256(ID+ addr+ c) ; 10: j i i  s=ECDSA.Sign(H, sk); 11: j   {tilde over (s)}.push(s) ; 12:  endfor 13: v i  setAnmVote( addr, a{tilde over (d)}dr, {tilde over (s)}, {tilde over (c)} ); 14:  Return ({tilde over (x)}, {tilde over (c)}, γ, δ) ;

v i i i The algorithm BlindX first randomly generates two random strings γ and δ each including 32 bytes for performing a point multiplication operation in the elliptic curve cryptography (ECC) on inputted public key information (in a line indicated by 4). Then, an X-coordinate of a point on an elliptic curve is determined as a blinding factor (in a line indicated by 5), where a function getXpointFromPubkey is used to determine an X-coordinate of a point on the elliptic curve in the ECC. Next, the original commitment cis blinded to obtain new commitment values (in lines indicated by 6 and 7). In addition, the blinded commitment is signed for subsequent verification of authenticity. Specifically, a signature algorithm Sign in an ECDSA is called, and signing is performed by using the private key skof the voter v. Finally, the algorithm returns ({tilde over (x)}, {tilde over (c)}, γ, δ) as a blinding result.

In the algorithm BlindX, an algorithm setAnmVote in the smart contract in the blockchain is called, and is used to store address information of the voters, blinded string commitment information and signature information in the blockchain through a smart contract transaction. Firstly, a data structure is used to record information binding with the voter. For example, a structure in Table 1 may serve as the data structure (related to the voters) for recording that is stored in the blockchain. As shown in Table 1, address, PK, PKs and ID are basic public information, while the other three mapping data correspond to the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) of the voter for the ballot, and a data type of the three mapping data is a mapping vector characterized in that an index of the vector is represented by a data type of address in the blockchain.

TABLE 1 Blockchain data structure of voters Data type Data description address voter string PK string PKs string ID mapping(address string) si mapping(address string) ci mapping(address string) dsigs

The algorithm setAnmVote is an operation of uploading to the blockchain, and has no output. For example, details of the algorithm setAnmVote are as follows.

Algorithm setAnmVote Input (iV,  , s, c)  1: if(msg.sender==iV)then  2: v forj=0 to ndo  3: iS=  [j]  4: i is=ŝ[j]  5: i ic= ĉ[j]  6: if(voters[iV].si[iS])==0)then  7: i voters[iV].si[iS]=is; ;  8: i voters[iV].ci[iS]=ic;  9: endif 10:  endfor 11:  endif

i i i i In an Ethereum blockchain, IV represents an address of the voter and iS represents an address of a potential signer, iSand iCrepresents data generated in the algorithm BlindX, voters represents an array corresponding to the data structure in Table 1, and msg.sender in a line indicated by 1 represents an address of a transaction sender who calls the algorithm in the smart contract in the blockchain. The requirement in the line indicated by 1 ensures that only the voter himself is allowed to set the data (that is valid when the smart contract is called). Finally, once the algorithm is executed successfully, the algorithm uploads iSand iCto the blockchain, and the data is recorded in the blockchain. Anyone including the voter himself is not allowed to reset the recorded data.

103 i i In some embodiments of the present disclosure, in the step S, the commitment value tuple {tilde over (c)} is signed by using the ECDSA to obtain the signature tuple {tilde over (s)} by: performing the hash operation on a tuple (ID, addr,) to obtain the signature tuple {tilde over (s)}.

i i v IDand addrrepresent identification and address information of the target voter respectively, andrepresents a commitment value in the commitment value tuple {tilde over (c)} corresponding to a voter n.

n v i i 1 2 n v n v i i n v i n v 1 2 n v Firstly, a hash value Hof the tuple (ID, addr,) corresponding to voters v, v, . . . , v, is calculated, where v≠v, and vrepresents the target voter. The target voter signs for other different voters by using the signature algorithm in the ECDSA, i.e., s=ECDSA·Sign (sk, H), to obtain the signature tuple {tilde over (s)}=(s, s, . . . , s).

i i i Subsequently, information of (ID, addr, {tilde over (c)}, {tilde over (s)}) is recorded in the blockchain through the smart contract, by using the algorithm setAnmVote in the smart contract. In addition, it should be noted that {tilde over (x)} is kept by the voter vin secret in this stage.

104 In some embodiments of the present disclosure, in the step S, the signature tuple {tilde over (d)} of other voters may be calculated by using a preset algorithm BlindS.

n v n v n v n v 1 2 n v 1 2 n v First, each of other voters verifies validity of a signature by using a verification algorithm in the ECDSA. In order to verify the signature, the signature in the blockchain is queried by using an algorithm getAnmVote in the smart contract. In a case that it is verified that the signature is valid, the voter generates a blind signature din a blind signature protocol by using the blind signature algorithm BlindS, i.e., d←BlindS(, sk), and uploads the blind signature dto the blockchain by using an algorithm signAnmVote in the smart contract. Finally, {tilde over (d)}=(d, d, . . . , d) is determined as a blind signature tuple of the different voters v, v, . . . , v.

For example, details of the algorithm BlindS are as follows.

Algorithm BlindS n v Input ((  , sk)) n v Output d  1: n v n v i n v  (v, s, ĉ)=getAnmtVote( addr, addr);  2: i if v ≠ addrthen  3: Return 0  4: endif  5: i i n v H=SHA256( ID+ addr+ ĉ);  6: n v i S=ECDSA.Verify( s, H, pk);  7: ifS==Truethen  8: n v n v n v   d=  − ĉ* sk  9: else 10:   Return 0 11:   end if; 11: i n v   signAnmVote( addr, d); 12: n v   Return d

n v n v n v n v n v n v n v Firstly, the signer queries the commitment data (v, s, ĉ) generated for him by using the algorithm getAnmVote in the smart contract. Anyone is allowed to query the commitment data based on a public account address in the blockchain. Then, the validity of the signature in the commitment data is verified by using the hash algorithm SHA256 and the verification algorithm in the ECDSA in cryptography (where a verification result S is generated in the two steps). In a case that it is verified that the signature is valid (S==True), the voter as the signer generates the blind signature dof the queried commitment ĉbased on inputted private key parameters by using−ĉ*sk. Subsequently, the blind signature is uploaded to the blockchain by calling the algorithm signAnmVote in the smart contract for uploading to the blockchain. Similarly, a requirement in a line indicated by 2 ensures that only the signer himself is allowed to set corresponding data. Once the signature is recorded, anyone including the signer himself is not allowed to reset the signature. Finally, the algorithm BlindS returns the generated blind signature d.

Further, in the above algorithm BlindS, two algorithms getAnmVote and signAnmVote in the smart contract in the blockchain are called. The algorithm getAnmVote is an algorithm for query operation. For example, details of the algorithm getAnmVote are as follows.

Algorithm getAnmVote Input (iV, iS) i i Output (V, is, ic) 1: Return(voters[iV].voter,voters[iV].si[iS],voters[iV].ci[iS]);

i i The algorithm getAnmVote has two input parameters iV and iS, iV represents the address of the voter, and iS represents the address of the potential signer in the Ethereum blockchain. The algorithm getAnmVote outputs an address V, and a signature isand a commitment icof the voter recorded in a current block in the blockchain. After the algorithm starts, the algorithm directly returns a field of voter, a field of an iV position of si, and a field of an iV position of ci corresponding to a current address iV in the data structure of voters.

The algorithm signAnmVote is the operation of uploading to the blockchain, and has no output. The algorithm signAnmVote is used to upload the blind signature generated by the algorithm BlindS to the blockchain. For example, details of the algorithm signAnmVote are as follows.

Algorithm signAnmVote Input (iV, idsig) 1: if(voters[iV].voter==msg.sender and voters[iV].dsigs[msg.sender]).length==0)then 2: voters[iV].dsigs[msg.sender]=idsig; 3: endif

The algorithm signAnmVote has two input parameters iV and idsig. In the blockchain, iV represents the address of the voter, and idsig represents a blind signature corresponding to the address. msg.sender in a line indicated by 1 represents an address (that is an address of the signer of the blind signature) of a transaction sender who calls the algorithm in the smart contract in the blockchain. The requirement in the line indicated by 1 ensures that only the signer himself is allowed to upload data to the blockchain.

i v i A workflow of the voting stage is described above. At the end of this stage, ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) is the vote tuple of the target voter vfor the ballot m.

101 105 108 v i Next, an opening voting stage is described. In some embodiments of the present disclosure, the hash output mentioned in the above step Sfurther includes a commitment value o, and the trusted anonymous voting method based on a blockchain may further include the following steps Sto S.

105 In step S, the signature tuple {tilde over (d)} and the commitment value tuple {tilde over (x)} are obtained from the blockchain, and a signature tuple {tilde over (y)} of other voters is calculated based on the signature tuple {tilde over (d)}.

106 n v v i n v In step S, validity of a signature element yis verified based on the commitment value cand the commitment value tuple {tilde over (x)} by using a preset algorithm VerifyS to obtain all signature elements ythat pass the verification.

n v v i n v i n v n v v i n v n v n v n v v v i i n v n v 1 2 n v Specifically, (x, c, y) is given, and the target voter vmay verify the validity of the signature element ythrough an algorithm VerifyS(x, c, y, pk). xrepresents a commitment value stored in the blockchain. yrepresents the signature element in the signature tuple {tilde over (y)} corresponding to the voter nfor the commitment value c. The target voter vmay calculate {tilde over (y)} according to y=d+γ. {tilde over (y)} is expressed as {tilde over (y)}=(y, y, . . . , y), and γ represents a random key.

107 n v n v n v n v In step S, a commitment string xcorresponding to each of the signature elements ythat passes the verification is obtained, a new signature tuple {tilde over (y)} is established based on all the signature elements ythat pass the verification, and a new commitment tuple {tilde over (x)} is established based on all commitment strings x.

108 v i v i In step S, a vote tuple (c, o, {tilde over (x)}, {tilde over (y)}) is uploaded to the blockchain with a random address.

v i v i The vote tuple (c, o, {tilde over (x)}, {tilde over (y)}) may serve as voting content in the opening voting stage. It can be understood that the target voter v may select a random address in the blockchain to send the transaction, so that anyone cannot find out who sends the transaction.

For example, details of the algorithm VerifyS are as follows.

Algorithm VerifyS n v v i n v n v Input (x, c, y, pk) Output True or False n v n v n v 1: B = x* pk* y* G 2: bx=getXpointFromPubkey(B) modn; v i 3: H=SHA256( c+bx); n v 4: if H == xthen 5: ReturnTrue 6: else 7: ReturnFalse 8: end if

v i n v Firstly, a point B on the elliptic curve in the ECC is calculated. Subsequently, an X-coordinate of the point B on the elliptic curve is determined in the algorithm. Next, the algorithm performs a hash operation on the original commitment cand the X-coordinate of the point B by using the SHA256 to obtain a hash value. In a case that the hash value is the same as the inputted value x, the commitment is valid. Finally, the algorithm outputs True or False based on the determination.

109 110 Next, a verification/tally stage is described. In some embodiments of the present disclosure, the trusted anonymous voting method based on a blockchain may further include the following steps Sand S.

109 v i v i In step S, the vote tuple (c, o, {tilde over (x)}, {tilde over (y)}) is obtained from the blockchain, and the signature tuple {tilde over (y)} is verified by using a preset algorithm V.

110 v i v i In step S, in a case that more than a preset proportion of signature elements ŷ in the signature tuple {tilde over (y)} pass the verification, the original voting content is verified based on the commitment tuples cand oby using the preset algorithm.

110 1 3 v i v i In some embodiments of the present disclosure, in the step S, the original voting content is verified based on the commitment tuples cand oby using the preset algorithm by the following steps Sto S.

1 v i v i In step S, the commitment tuple ois serialized to obtain a serialized string of commitment tuple o.

2 v i In step S, the hash operation is performed on the inputted original voting content m and the serialized string of commitment tuple oto obtain a hash value ĉ.

3 v i v i In step S, it is determined whether ĉ is equal to c. In a case that ĉ is equal to c, it is determined that the original voting content m passes the verification.

For example, in the verification/tally stage, details of the algorithm V are as follows.

Algorithm V Input (m, c, o) Output True or False 1: ĉ =SHA256(m+serialize(o)); 2: if ĉ == c then 3: ReturnTrue; 4: else 5: ReturnFalse; 6: end if

Firstly, the hash operation is performed on the inputted original voting content m and o by using the hash algorithm SHA256 to obtain the hash value ĉ, where the function serialize( ) in the algorithm V is used to serialize the string o. Then, it is determined whether e is equal to the inputted c. In a case that ĉ is equal to the inputted c, it indicates that the voting passes the verification and True is outputted, otherwise False is outputted.

A trusted anonymous voting apparatus based on a blockchain according to an embodiment of the present disclosure is described below. The trusted anonymous voting apparatus based on a blockchain described below and the trusted anonymous voting method based on a blockchain described above may be referred to each other.

3 FIG. 21 22 23 24 Referring to, the trusted anonymous voting apparatus based on a blockchain according to an embodiment of the present disclosure may include a commitment unit, a blinding unit, a signature unit, and a voting unit.

21 v i The commitment unitis configured to perform a hash operation on original voting content to obtain a hash output. The hash output includes a commitment value c.

22 v i The blinding unitis configured to blind the commitment value cbased on information of other voters to obtain a commitment value tuple {tilde over (c)} and a commitment value tuple {tilde over (x)}.

23 The signature unitis configured to sign the commitment value tuple {tilde over (c)} by using an ECDSA to obtain a signature tuple {tilde over (s)}.

24 The voting unitis configured to establish a vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) based on the commitment value tuple {tilde over (c)}, the signature tuple {tilde over (s)} and a signature tuple {tilde over (d)} of other voters, and upload the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) and the commitment value tuple {tilde over (x)} to the blockchain. The vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) serves as voting content in a voting stage.

The signature tuple {tilde over (d)} is generated in a case that other voters verify the signature tuple s and the signature tuple {tilde over (s)} passes the verification. The commitment value tuple {tilde over (x)} is used to decrypt the vote tuple.

21 v i v i In some embodiments of the present disclosure, the commitment unitmay perform the hash operation on the original voting content to obtain the commitment value cby: performing the hash operation on the original voting content m and a string o to obtain the commitment value c, where the string o is randomly generated.

22 v i j j v i j j j j i In some embodiments of the present disclosure, the blinding unitmay blind the commitment value cbased on the information of other voters to obtain the commitment value tuple {tilde over (c)} and the commitment value tuple {tilde over (x)} by: performing, for each of other voters, a point multiplication operation in an elliptic curve cryptography (ECC) on public key information pkandof the voter to obtain a blinding factor t; hashing the commitment value cbased on the blinding factor tto a new commitment value xi and a new commitment value c; and collecting commitment values xto obtain a commitment value tuple {tilde over (x)}, and signing each of commitment values cby using a private key skto obtain the commitment value tuple {tilde over (c)}.

23 i i i i v In some embodiments of the present disclosure, the signing unitmay sign the commitment value tuple {tilde over (c)} by using the ECDSA to obtain the signature tuple {tilde over (s)} by: performing the hash operation on a tuple (ID, addr,) to obtain the signature tuple {tilde over (s)}, where IDand addrrepresent identification and address information of a target voter respectively, andrepresents a commitment value in the commitment value tuple {tilde over (c)} corresponding to the voter n.

21 30 v i 4 FIG. In some embodiments of the present disclosure, the hash output mentioned in the commitment unitfurther includes a commitment value o. Referring to, the trusted anonymous voting apparatus based on a blockchain may further include an opening voting unit.

30 n v v i n v n v v n v n v n v n v v i v i v i v i The opening voting unitis configured to: obtain the signature tuple {tilde over (d)} and the commitment value tuple {tilde over (x)} from the blockchain, and calculate a signature tuple {tilde over (y)} of other voters based on the signature tuple {tilde over (d)}; verify validity of ybased on the commitment value cand the commitment value tuple {tilde over (x)} by using a preset algorithm VerifyS to obtain all signature elements ythat pass the verification, where yrepresents a signature element in the signature tuple {tilde over (y)} corresponding to the voter n; obtain a commitment string xcorresponding to each of the signature elements ythat pass the verification, establish a new signature tuple {tilde over (y)} based on all the signature elements ythat pass the verification, and establish a new commitment tuple {tilde over (x)} based on all commitment strings x; and upload a vote tuple (c, o, {tilde over (x)}, {tilde over (y)}) to the blockchain with a random address, where the vote tuple (c, o, {tilde over (x)}, {tilde over (y)}) serves as voting content in the opening voting stage.

5 FIG. 40 In some embodiments of the present disclosure, referring to, the trusted anonymous voting apparatus based on a blockchain may further include a verification tally unit.

40 v i v i v i v i The verification tally unitis configured to: obtain the vote tuple (c, o, {tilde over (x)}, {tilde over (y)}) from the blockchain, and verify the signature tuple {tilde over (y)} by using a preset algorithm V; and verify, in a case that more than a preset proportion of signature elements ŷ in the signature tuple {tilde over (y)} pass the verification, the original voting content based on the commitment tuples cand oby using the preset algorithm.

40 v i v i v i v i v i v i v i In some embodiments of the present disclosure, the verification tally unitmay verify the original voting content based on the commitment tuples cand oby using the preset algorithm by: serializing the commitment tuple oto obtain a serialized string of commitment tuple o; performing the hash operation on the inputted original voting content m and the serialized string of commitment tuple oto obtain a hash value ĉ; and determining whether Ĉ is equal to c, and determining that the original voting content m passes the verification, in a case that ĉ is equal to c.

6 FIG. 6 FIG. 31 32 33 34 The trusted anonymous voting apparatus based on a blockchain according to the embodiments of the present disclosure is applicable to a trusted anonymous voting device based on a blockchain, such as a computer. In an embodiment,is a block diagram showing a hardware structure of a trusted anonymous voting device based on a blockchain. Referring to, the hardware structure of the trusted anonymous voting device based on a blockchain may include at least one processor, at least one communication interface, at least one memoryand at least one communication bus.

31 32 33 34 31 32 33 34 In the embodiment of the present disclosure, the number of each of the processor, the communication interface, the memory, and the communication busis at least one. In addition, the processor, the communication interface, and the memorycommunicate with each other through the communication bus.

31 The processormay be a central processing unit (CPU), an application specific integrated circuit (ASIC), one or more integrated circuits configured to implement the embodiments of the present disclosure, or the like.

32 The memorymay include a high-speed RAM memory, and may further include a non-volatile memory and the like, such as at least one disk memory.

33 31 33 v i v i The memorystores a program, and the processormay call the program stored in the memory. The program is used to: perform a hash operation on original voting content to obtain a hash output, where the hash output includes a commitment value c; blind the commitment value c, based on information of other voters to obtain a commitment value tuple {tilde over (c)} and a commitment value tuple {tilde over (x)}; sign the commitment value tuple {tilde over (c)} by using an ECDSA to obtain a signature tuple {tilde over (s)}; and establish a vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) based on the commitment value tuple {tilde over (c)}, the signature tuple {tilde over (s)} and a signature tuple {tilde over (d)} of other voters, and upload the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) and the commitment value tuple {tilde over (x)} to the blockchain, where the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) serves as voting content in a voting stage. The signature tuple {tilde over (d)} is generated in a case that other voters verify the signature tuple {tilde over (s)} and the signature tuple {tilde over (s)} passes the verification. The commitment value tuple {tilde over (x)} is used to decrypt the vote tuple.

In an embodiment, a refinement function and an expansion function of the program may refer to the above description.

v i v i A storage medium is further provided according to an embodiment of the present disclosure. The storage medium stores a program executable by the processor. The program is used to: perform a hash operation on original voting content to obtain a hash output, where the hash output includes a commitment value c; blind the commitment value cbased on information of other voters to obtain a commitment value tuple {tilde over (c)} and a commitment value tuple; {tilde over (x)}; sign the commitment value tuple {tilde over (c)} by using an ECDSA to obtain a signature tuple {tilde over (s)}; and establish a vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) based on the commitment value tuple {tilde over (c)}, the signature tuple {tilde over (s)} and a signature tuple {tilde over (d)} of other voters, and upload the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) and the commitment value tuple {tilde over (x)} to the blockchain, where the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) serves as voting content in a voting stage. The signature tuple {tilde over (d)} is generated in a case that other voters verify the signature tuple {tilde over (s)} and the signature tuple {tilde over (s)} passes the verification. The commitment value tuple {tilde over (x)} is used to decrypt the vote tuple.

In an embodiment, a refinement function and an expansion function of the program may refer to the above description.

v i v i In summary, in the present disclosure, a hash operation is performed on the original voting content to obtain the hash output. The hash output includes the commitment value c. The hash operation enables the original voting content to be hidden well. Then, the commitment value cis blinded based on the information of other voters, to obtain the commitment value tuples {tilde over (c)} and {tilde over (x)}, so that identification of the voter is hidden well through the blinding. Next, the commitment value tuple {tilde over (c)} is signed by using the ECDSA to obtain the signature tuple {tilde over (s)}. The commitment value tuple is signed by the voter himself, so that the voting content is authenticated by the target voter, thereby preventing the voting content from being forged by others. Finally, the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) is established based on the commitment value tuple {tilde over (c)}, the signature tuple {tilde over (s)} and the signature tuple {tilde over (d)} of other voters, and the vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) and the commitment value tuple {tilde over (x)} are uploaded to the blockchain. The vote tuple ({tilde over (c)}, {tilde over (s)}, {tilde over (d)}) serves as the voting content in the voting stage. The signature tuple {tilde over (d)} is generated in a case that other voters verify the signature tuple {tilde over (s)} and the signature tuple {tilde over (s)} passes the verification. Due to verification and signature by other voters, the target voter cannot tamper with the voting content. The commitment value tuple {tilde over (x)} is used to decrypt the vote tuple, facilitating subsequent opening of the voting content and tally. In the present disclosure, through the above processing, the voting content is hidden and anonymity and verifiability of the voting are achieved

Further, compared with the conventional decentralized anonymous voting solution, the solution in the present disclosure has characteristics of the blockchain such as decentralization, traceability and tamper proof. In addition, compared with other distributed timestamp solution based on a blockchain, this solution has higher efficiency. The present disclosure effectively achieves seven security design goals, namely: fairness (ensuring that anyone is not allowed to obtain ballot results of others before submitting his/her ballot, which indicates that the choice of a voter is not influenced by those who vote ahead), decentralization (ensuring that any kind of trusted third party, such as an election administrator or an independent observer is eliminated from a voting protocol), eligibility (ensuring that a right of he/she is checked before a voter begins to vote; in addition, the eligibility ensures that each voter is allowed to vote only once), anonymity (ensuring that the privacy of the voters is protected to make sure that no one is allowed to know an owner of a ballot from the voting result at the end), compatibility (ensuring that the voting solution is as simple as possible, so that the voting solution can be integrated into an information system of the Internet of energy), verifiability (ensuring that all the stages of voting are audited by the voters, in addition, the validity of each vote is able to be verified by anyone), and coercion resistance (ensuring that the voting solution is coercion-resistant in order to avoid someone trying to coerce the voters to vote by following their instruction). In particular, the trusted anonymous voting solution according to the present disclosure is implemented based on the blockchain, compared with a large number of conventional trusted anonymous voting solutions implemented based on a platform such as a PoW consensus algorithm, the solution according to the present disclosure has a faster transaction processing speed.

Finally, it should be further noted that the relationship terms herein such as first, second and the like are only used to distinguish one entity or operation from another entity or operation, rather than necessitate or imply any actual relationship or order between these entities or operations. Moreover, the terms “comprise”, “include”, or any other variants thereof are intended to encompass a non-exclusive inclusion, such that the process, method, article, or device including a series of elements includes not only those elements but also those elements that are not explicitly listed, or the elements that are inherent to such process, method, article, or device. Unless explicitly limited, the statement “including a . . . ” does not exclude the case that other similar elements may exist in the process, the method, the article or the device other than enumerated elements.

The embodiments in this specification are described in a progressive way, each of which emphasizes the differences from others. The embodiments may be combined as needed, and the same or similar parts among the embodiments may be referred to each other.

The above descriptions of the disclosed embodiments enable those skilled in the art to implement or use the present disclosure. Various modifications to the embodiments are apparent to those skilled in the art, and general principles defined in the present disclosure may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure should not be limited to the embodiments described herein but should be defined by the widest scope that complies with the principle and novel features disclosed in this specification.